CVE-2026-116130: HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request

Q: Which deployments are exposed to this issue?

Deployments using the XS backend of HTTP::Parser::XS before version 0.18 are affected. The pure-Perl backend is not affected.

Q: What does an attacker need to exploit it?

An attacker needs to be able to send an HTTP request containing an encoded NUL byte (%00) in the path. Exploitation relies on a proxy or filter evaluating the full path while the application routes based on the truncated PATH_INFO value.

Q: What can be done if upgrading is not immediately possible?

Use the pure-Perl backend instead of the affected XS backend where feasible. Ensure proxies and filters do not make security decisions on a path representation that differs from the application’s routed PATH_INFO.

Published Oct 30, 2026

Updated

HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest.

The XS parser URL-decodes the request path and measures the result with strlen(), so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

A remote attacker can send a path that a proxy or filter checks in full while the application routes on a shorter one.

Affected Software

4 affected componentsFixes available

debian/libhttp-parser-xs-perl*

debian/libhttp-parser-xs-perl<=0.17-2

0.18-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/libhttp-parser-xs-perl to a version that resolves this vulnerability.
Fixed in 0.18-1
Upgrade
Upgrade HTTP::Parser::XS to a version that resolves this vulnerability.
Fixed in 0.18

Event History

Oct 30, 2026

CVE Published

via MITRE·12:38 PM

Data Sourced

via MITRE·12:38 PM

RemedyDescriptionWeakness

Data Sourced

via OSV·12:38 PM

DescriptionWeakness

Data Sourced

via NVD·01:18 PM

DescriptionWeakness

Data Sourced

via OSV·01:18 PM

Affected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using the XS backend of HTTP::Parser::XS before version 0.18 are affected. The pure-Perl backend is not affected.

What does an attacker need to exploit it?

An attacker needs to be able to send an HTTP request containing an encoded NUL byte (%00) in the path. Exploitation relies on a proxy or filter evaluating the full path while the application routes based on the truncated PATH_INFO value.

What can be done if upgrading is not immediately possible?

Use the pure-Perl backend instead of the affected XS backend where feasible. Ensure proxies and filters do not make security decisions on a path representation that differs from the application’s routed PATH_INFO.

CVE-2026-116130: HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What can be done if upgrading is not immediately possible?